• Olaf Hering's avatar
    xen/pv-on-hvm kexec: prevent crash in xenwatch_thread() when stale watch events arrive · c4c303c7
    Olaf Hering authored
    During repeated kexec boots xenwatch_thread() can crash because
    xenbus_watch->callback is cleared by xenbus_watch_path() if a node/token
    combo for a new watch happens to match an already registered watch from
    an old kernel.  In this case xs_watch returns -EEXISTS, then
    register_xenbus_watch() does not remove the to-be-registered watch from
    the list of active watches but returns the -EEXISTS to the caller
    anyway.
    
    Because the watch is still active in xenstored it will cause an event
    which will arrive in the new kernel. process_msg() will find the
    encapsulated struct xenbus_watch in its list of registered watches and
    puts the "empty" watch handle in the queue for xenwatch_thread().
    xenwatch_thread() then calls ->callback which was cleared earlier by
    xenbus_watch_path().
    
    To prevent that crash in a guest running on an old xen toolstack remove
    the special -EEXIST handling.
    
    v2:
     - remove the EEXIST handing in register_xenbus_watch() instead of
       checking for ->callback in process_msg()
    Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: default avatarOlaf Hering <olaf@aepfle.de>
    c4c303c7
xenbus_xs.c 20.4 KB